syzbot


kernel BUG at net/rxrpc/recvmsg.c:LINE!

Status: fixed on 2020/09/16 22:51
Subsystems: afs net
[Documentation on labels]
Reported-by: syzbot+b54969381df354936d96@syzkaller.appspotmail.com
Fix commit: 65550098c1c4 rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
First crash: 1624d, last: 1595d
Cause bisection: failed (error log, bisect log)
  
Discussions (6)
Title Replies (including bot) Last reply
[PATCH 4.14 000/228] 4.14.194-rc1 review 234 (234) 2020/08/21 06:59
[PATCH 4.19 00/48] 4.19.139-rc1 review 61 (61) 2020/08/11 16:45
[PATCH 5.7 00/79] 5.7.15-rc1 review 83 (83) 2020/08/11 14:23
[PATCH 5.4 00/67] 5.4.58-rc1 review 71 (71) 2020/08/11 14:23
[PATCH net] rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2 (2) 2020/07/30 23:51
kernel BUG at net/rxrpc/recvmsg.c:LINE! 0 (1) 2020/07/03 23:31

Sample crash report:
------------[ cut here ]------------
kernel BUG at net/rxrpc/recvmsg.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6847 Comm: syz-executor427 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:rxrpc_recvmsg+0x18ab/0x1a03 net/rxrpc/recvmsg.c:605
Code: 89 e7 e8 28 f3 6e fa e9 eb fc ff ff e8 1e f3 6e fa e9 33 ef ff ff 48 8b 7c 24 10 e8 0f f3 6e fa e9 dc ee ff ff e8 85 9d 2f fa <0f> 0b 48 8b 7c 24 10 e8 f9 f2 6e fa e9 76 ee ff ff 48 89 ef e8 dc
RSP: 0018:ffffc90001677858 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880a3c6fc78 RCX: ffffffff87440877
RDX: ffff88808ef28200 RSI: ffffffff874419db RDI: 0000000000000001
RBP: ffff8880a2a3e700 R08: 0000000000000000 R09: ffff8880a3c6fd27
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a3c6fa80 R14: 0000000000000000 R15: ffff8880a3c6fd20
FS:  00007f513f99a700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006db0f0 CR3: 000000009f106000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sock_recvmsg_nosec net/socket.c:886 [inline]
 sock_recvmsg net/socket.c:904 [inline]
 sock_recvmsg net/socket.c:900 [inline]
 ____sys_recvmsg+0x2c4/0x640 net/socket.c:2575
 ___sys_recvmsg+0x127/0x200 net/socket.c:2617
 do_recvmmsg+0x24d/0x6d0 net/socket.c:2715
 __sys_recvmmsg net/socket.c:2794 [inline]
 __do_sys_recvmmsg net/socket.c:2817 [inline]
 __se_sys_recvmmsg net/socket.c:2810 [inline]
 __x64_sys_recvmmsg+0x20b/0x260 net/socket.c:2810
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446cd9
Code: Bad RIP value.
RSP: 002b:00007f513f999d98 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00000000006dcc38 RCX: 0000000000446cd9
RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000003
RBP: 00000000006dcc30 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dcc3c
R13: 0000000000000007 R14: 0000000100000110 R15: 0000000000000018
Modules linked in:
---[ end trace 391013e7a9eff1f7 ]---
RIP: 0010:rxrpc_recvmsg+0x18ab/0x1a03 net/rxrpc/recvmsg.c:605
Code: 89 e7 e8 28 f3 6e fa e9 eb fc ff ff e8 1e f3 6e fa e9 33 ef ff ff 48 8b 7c 24 10 e8 0f f3 6e fa e9 dc ee ff ff e8 85 9d 2f fa <0f> 0b 48 8b 7c 24 10 e8 f9 f2 6e fa e9 76 ee ff ff 48 89 ef e8 dc
RSP: 0018:ffffc90001677858 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880a3c6fc78 RCX: ffffffff87440877
RDX: ffff88808ef28200 RSI: ffffffff874419db RDI: 0000000000000001
RBP: ffff8880a2a3e700 R08: 0000000000000000 R09: ffff8880a3c6fd27
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff8880a3c6fa80 R14: 0000000000000000 R15: ffff8880a3c6fd20
FS:  00007f513f99a700(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f03564ac000 CR3: 000000009f106000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/07/04 07:12 upstream 7cc2a8ea1048 51095195 .config console log report syz C ci-upstream-kasan-gce-selinux-root
2020/07/03 18:03 linux-next aab2003999e7 bed10395 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2020/08/01 09:45 upstream d8b9faec54ae d895b3be .config console log report ci-upstream-kasan-gce-root
2020/07/28 09:40 upstream 92ed30191993 cb93dc6a .config console log report ci-upstream-kasan-gce-root
2020/07/13 07:59 upstream 4437dd6e8f71 9ebcc5b1 .config console log report ci-upstream-kasan-gce
2020/07/06 15:58 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce-smack-root
2020/07/05 02:44 upstream 7cc2a8ea1048 51095195 .config console log report ci-upstream-kasan-gce-smack-root
2020/08/01 09:59 linux-next 01830e6c042e d895b3be .config console log report ci-upstream-linux-next-kasan-gce-root
2020/07/03 16:34 linux-next aab2003999e7 bed10395 .config console log report ci-upstream-linux-next-kasan-gce-root
2020/07/03 08:13 linux-next aab2003999e7 bed10395 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.